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DETAILED ACTION 
Response to Arguments 

1 , Applicant amended claims 1 , 7, 18 and 22 in the amendment filed on 
04/22/2004, and re-amended claim 1 in the amendment filed on 06/04/2004. The 
changes of claim 1 are not intended to narrow the scope of claim 1 in any manner, and 
the request of changes was initiated by examiner in the teleconference on June 3, 2004. 

Examiner thanks you applicant and applicant's representative, Jody Bishop, for 
cooperating with examiner by re-amending claim 1 to make it consistent with claims 13 
and 18 because the claims were allowable over the art of record as indicated by 
examiner in the teleconference. However, by updating the search, the claims are still 
anticipated, or rendered obvious over USP 6,182,249 that was issued to Wookey et al. 
Therefore, another non final Office Action will be detailed as below. Examiner truly 
regrets and apologizes for any inconvenience may cause due to the examiner's 
indication of allowance in the teleconference. 
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Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 
U.S.C. 102 that form the basis for the rejections under this section made in this Office 
action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351 (a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

3. Claims 1-5 and 8-12 are rejected under 35 U.S.C. 102(e) as being 
anticipated by Wookey et al. [USP 6,182,249]. 

Regarding to claim 1 , Wookey teaches a method of monitoring the state and 
generating alerts indicating predefined conditions exist in a computer system (Abstract 
and Col. 1, Lines 20-23). As shown in FIGS. 1a and lb, computer system 100 receives 
raw diagnostic data from a monitored computer system 102. Monitored computer 
system 102 runs diagnostic tests on a periodic basis (Col. 3, Line 63-Col. 4, Line 26) by 
using a reporting application^ which includes computer-executable software code stored to a 
computer-readable medium as shown in FIG. 2. The raw diagnostic data, which contains 
information about the software and hardware components in monitored system 102, is 
processed to extract the information associated with hardware and software to create a 
host state, which is the state of the monitored system over the particular time period that 
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the diagnostic tests were run (Col. 5, Lines 31-47). FIG. 11 is an example of the host 
state. Once host states have been created, the data can be analyzed for the presence 
of alerts, which are predefined conditions in the various components of the monitored 
computer system that indicate operating conditions within the system. Two available 
types of alerts are spot alert and predictive alert (Col. 11, Line 56-Col. 12, Line 26). For 
example, if an alert is to determine if a particular partition has exceeded a 
predetermined percentage used, the alert includes a token for the partition name, e.g., 
/var. A second token utilized is partition percentage used. The alert determines if 
partition name=/var AND percentage used is 80%. When those two conditions are true, 
the alert is raised (Col. 12, Lines 44-55). As seen, the reporting application receives alert 
as a request from a client to notify said client of a condition of an attribute of a system, and 
an alert as request comprises a name of the monitored system attribute also a 
predetermined condition as information specifying a query for said system attribute. The 
defined alert with information specifying a query and the reporting application is used for 
monitoring said system for a particular value of a system component has exceeded a 
threshold value, or the number of memory parity errors is increasing (Col. 12, Lines 2-7 
and 21-26) as existence of said condition of said attribute. The technique as discussed 
also performs the step of receiving by said reporting application raw diagnostic data from 
said system as illustrated from Col. 3, Line 63 to Col. 4, Line 26. In order to extract 
information from the diagnostic data stream, "token types" are utilized. Each token has 
a label and a value. The value of the token provides a value extracted from the 
diagnostic data that gives value to the element (Col. 7, Lines 10-20). An element can 
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have a token defined that is the nnathematical result of other tokens. For example, a 
disk space free token is derived from a simple subtraction from a disk used token and a 
total disk space token (Col. 9, Lines 42-49). A spot alert could result when the number 
of parity errors exceeds a predetermined threshold, or when the root partition of a disk 
exceeds 99%, and an alert would be issued (Col. 12, Lines 4-13). As seen, the 
technique as discussed indicates the step of deriving said data about said system attribute 
to determine if said condition exists, and upon determining that said condition exist, an alert 
is issued for notifying said client of the existence of said condition. 

Regarding to claim 2, Wookey teaches all the claimed subject matters as 
discussed in claim 1 , Wookey further discloses the step of generating derived data based 
upon the result of said query of said system (Col. 7, Lines 1 0-20 and Col. 9, Lines 42-49). 

Regarding to claims 3, Wookey teaches all the claimed subject matters as 
discussed in claims 1 , Wookey further discloses condition is a change in said attribute 
(Col. 12, Lines 4-13). 

Regarding to claim 4, Wookey teaches a method of monitoring the state and 
generating alerts indicating predefined conditions exist in a computer system (Abstract 
and Col. 1, Lines 20-23). As shown in FIGS, la and lb, computer system 100 receives 
raw diagnostic data from a monitored computer system 102. Monitored computer 
system 102 runs diagnostic tests on a periodic basis (Col. 3, Line 63-Col. 4, Line 26). 
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The raw diagnostic data, which contains information about the software and hardware 
components in monitored system 102, is processed to extract the information 
associated with hardware and software to create a host state, which is the state of the 
monitored system over the particular time period that the diagnostic tests were run (Col. 
5, Lines 31-47). FIG. 11 is an example of the host state. Once host states have been 
created, the data can be analyzed for the presence of alerts, which are predefined 
conditions in the various components of the monitored computer system that indicate 
operating conditions within the system. Two available types of alerts are spot alert and 
predictive alert (Col. 1 1 , Line 56-Col. 1 2, Line 26). For example, if an alert is to 
determine if a particular partition has exceeded a predetermined percentage used, the 
alert includes a token for the partition name, e.g., /var. A second token utilized is 
partition percentage used. The alert determines if partition name=/var AND percentage 
used is 80%. When those two conditions are true, the alert is raised (Col. 12, Lines 44- 
55). As seen, alert as a request is received from a client to notify said client of a condition of 
an attribute of a system, and an alert as request comprises a name of the monitored system 
attribute also a predetermined condition as information specifying a query for said system 
attribute, wherein attribute is status of a peripheral device. The defined alert with 
information specifying a query for monitoring said system for a particular value of a 
system component has exceeded a threshold value, or the number of memory parity 
errors is increasing (Col. 12, Lines 2-7 and 21-26) as existence of said condition of said 
attribute. In order to extract information from the diagnostic data stream, "token types" 
are utilized. Each token has a label and a value. The value of the token provides a value 
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extracted from the diagnostic data that gives value to the element (Col. 7, Lines 10-20). 
An element can have a token defined that is the mathematical result of other tokens. 
For example, a disk space free token is derived from a simple subtraction from a disk 
used token and a total disk space token (Col. 9, Lines 42-49). A spot alert could result 
when the number of parity errors exceeds a predetermined threshold, or when the root 
partition of a disk exceeds 99%, and an alert would be issued (Col. 12, Lines 4-13). As 
seen, the technique as discussed indicates the step of deriving said data about said 
system attribute to determine if said condition exists, and upon determining that said 
condition exists an alert is issued for notifying said client of the existence of said condition. 

Regarding to claim 5, Wookey teaches all the claim subject matters as discussed 
in claim 1 , Wookey further discloses client is selected from the group consisting of a user 
and a client application program (FIG. 2). 

Regarding to claim 8, Wookey teaches all the claimed subject matters as 
discussed in claim 1 , Wookey further discloses information specifying a query for said 
system attribute comprises multiple transactions bracketed together (Col. 1 5, Lines 24-54). 

Regarding to claims 9, Wookey teaches all the claimed subject matters as 
discussed in claim 1 , Wookey further discloses multiple transactions bracketed together, 
wherein upon determining that such bracketed condition exist, notifying said client of the 
existence of such bracketed conditions (Col. 15, Lines 16-54). 
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Regarding to claim 10, Wookey teach all the claimed subject matters as 
discussed in claim 9, Wookey further discloses the multiple changes are bracketed 
together^ wherein upon determining that such bracketed changes exists notifying said client of 
the existence of such bracketed changes (Col. 1 5, Lines 1 6-54). 

Regarding to claim 1 1 , Wookey teaches all the claim subject matters as 
discussed in claim 1 , Wookey further discloses client is a graphical user interface (GUI) 
that displays information to a human user (Col. 1 6, Lines 41-58). 

Regarding to claim 12, Wookey teaches all the claim subject matters as 
discussed in claim 1 1 , Wookey further discloses the step of deriving data to determine if a 
condition of said one or more attributes exists such that the GUI should redraw the graphics 
displaying said information about said one or more attributes (Col. 1 6, Line 41 -Col. 1 7, Line 
18). 
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Claim Rejections - 35 (JSC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the Invention was made. 

This application currently names joint inventors. In considering patentability of 

the claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of 

the various claims was commonly owned at the time any inventions covered therein 

were made absent any evidence to the contrary. Applicant is advised of the obligation 

under 37 CFR 1 .56 to point out the inventor and invention dates of each claim that was 

not commonly owned at the time a later invention was made in order for the examiner to 

consider the applicability of 35 U.S.C. 1 03(c) and potential 35 U.S.C. 1 02(e), (f) or (g) 

prior art under 35 U.S.C. 103(a). 

5. Claims 13, 16-18 and 20-22 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Wookey et al. [USP 6,182,249]. 

Regarding to claims 13 and 18, Wookey teaches a method of monitoring the 
state and generating alerts indicating predefined conditions exist in a computer system 
(Abstract and Col. 1 , Lines 20-23). As shown in FIGS. 1 a and 1b, computer system 1 00 
receives raw diagnostic data from a monitored computer system 102. Monitored 
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computer system 102 runs diagnostic tests on a periodic basis (Col. 3, Line 63-Col. 4, 
Line 26) by using a reporting application as shown in FIG. 2. The raw diagnostic data, 
which contains information about the software and hardware components in monitored 
system 102, is processed to extract the information associated with hardware and 
software to create a host state, which is the state of the monitored system over the 
particular time period that the diagnostic tests were run (Col. 5, Lines 31-47). FIG. 1 1 is 
an example of the host state. Once host states have been created, the data can be 
analyzed for the presence of alerts, which are predefined conditions in the various 
components of the monitored computer system that indicate operating conditions within 
the system. Two available types of alerts are spot alert and predictive alert (Col. 1 1 , 
Line 56-Col. 12, Line 26). For example, if an alert is to determine if a particular partition 
has exceeded a predetermined percentage used, the alert includes a token for the 
partition name, /var, and a second token is partition percentage used. The alert 
determines if partition name =/var AND percentage used is 80%. When those two 
conditions are true, the alert is raised (Col. 12, Lines 44-55). As seen, the reporting 
application receives alert as a request from a client to notify said client of a condition of an 
attribute of a system, and an alert as request comprises a name of the monitored system 
attribute also a predetermined condition as information specifying a query for said system 
attribute. In order to extract information from the diagnostic data stream, "token types" 
are utilized. Each token has a label and a value. The value of the token provides a value 
extracted from the diagnostic data that gives value to the element (Col. 7, Lines 10-20). 
An element can have a token defined that is the mathematical result of other tokens. 
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For example, a disk space free token is derived from a simple subtraction from a disk 
used token and a total disk space token (Col. 9, Lines 42-49). A spot alert could result 
when the number of parity errors exceeds a predetermined threshold, or when the root 
partition of a disk exceeds 99%, and an alert would be issued (Col. 12, Lines 4-1 3). As 
seen, the technique as discussed indicates the step o^ deriving said data about said 
system attribute for determining from said derived data if said condition exists ^ and upon 
determining that said condition exist, notifying said client of the existence of said condition, 
Wookey does not explicitly teach the step of querying said system as specified by the alert 
as request. However, as disclosed by Wookey, an alert type is defines in a manner 
similar to a token type defining a token (CoL 12, Lines 46-48). If an alert is to determine 
if a particular partition has exceeded a predetermined percentage used, the alert 
includes a token for the partition name, /var, and a second token is partition percentage 
used. The alert determines if partition name =/var AND percentage used is 80%. When 
those two conditions are true, the alert is raised (Col. 12, Lines 44-55). A token type is 
defined in order to extract information from the diagnostic data by having in each token 
a token name and a test name (Col. 7, Lines 10-20). The diagnostic tests are run, and 
the results of those diagnostic tests are automatically provided at periodic intervals (Col. 
3, Line 63-CoL 4, Line 10). As seen, within an alert is a token, and obviously, the test for 
querying the system must be specified in the alert or request in order to have a partition 
percentage used as in the example above. Therefore, it would have been obvious for 
one of ordinary skill in the art at the time the invention was made to include the test for 



Application/Control Number: 09/422,998 Page 12 

Art Unit: 2172 

querying the system in the alert in order to issue an alert indicating predefined condition 
exist in a computer system. 

Regarding to claim 16, Wookey teaches all the claimed subject matters as 
discussed in claim 13, Wookey further discloses condition is a change in said attribute 
(Col. 12, Lines 4-13). 

Regarding to claim 17, Wookey teaches all the claimed subject matters as 
discussed in claim 13, Wookey further discloses multiple conditions bracketed together, 
wherein upon determining that such bracketed conditions exist, notifying said client of the 
existence of such bracketed conditions (Col. 15, Lines 16-54). 

Regarding to claim 20, Wookey teaches all the claim subject matters as 
discussed in claim 18, Wookey further discloses multiple nodes, wherein at least one of 
said nodes is executing said reporting application (FIG. 1 ). 

Regarding to claim 21 , Wookey teaches all the claim subject matters as 
discussed in claim 13, Wookey further discloses the step oi periodically querying the 
system (Col. 3, Line 63-Col. 4, Line 26). 
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Regarding to claim 22, Wookey teaches all the claimed subject matters as 
discussed in claim 1 8, Wookey further discloses the step of monitoring system to 
determine if said condition exist (Col. 12, Lines 44-55). 

6. Claims 7 and 14 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Wookey et al. [USP 6,182,249] In view of Sybase [Transact-SQL 
User's Guide, Copyright 1996]. 

Regarding to claim 7, Wookey teaches a method of monitoring the state and 
generating alerts indicating predefined conditions exist in a computer system (Abstract 
and Col. 1, Lines 20-23). As shown in FIGS, la and lb, computer system 100 receives 
raw diagnostic data from a monitored computer system 102. Monitored computer 
system 102 runs diagnostic tests on a periodic basis (Col. 3, Line 63-Col. 4, Line 26). 
The raw diagnostic data, which contains information about the software and hardware 
components in monitored system 102, is processed to extract the information 
associated with hardware and software to create a host state, which is the state of the 
monitored system over the particular time period that the diagnostic tests were run (Col. 
5, Lines 31-47). FIG. 11 is an example of the host state. Once host states have been 
created, the data can be analyzed for the presence of alerts, which are predefined 
conditions in the various components of the monitored computer system that indicate 
operating conditions within the system. Two available types of alerts are spot alert and 
predictive alert (Col. 11, Line 56-Col. 12, Line 26). For example, if an alert is to 
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determine if a particular partition has exceeded a predetermined percentage used, the 
alert includes a token for the partition name, /var, and a second token is partition 
percentage used. The alert determines if partition name =/var AND percentage used is 
80%. When those two conditions are true, the alert is raised (Col. 12, Lines 44-55). As 
seen, alert as a request is received from a client to notify said client of a condition of an 
attribute of a system, and an alert as request comprises a name of the monitored system 
attribute also a predetermined condition as information specifying a query for said system 
attribute. In order to extract information from the diagnostic data stream, "token types" 
are utilized. Each token has a label and a value. The value of the token provides a value 
extracted from the diagnostic data that gives value to the element (Col. 7, Lines 10-20). 
An element can have a token defined that is the mathematical result of other tokens. 
For example, a disk space free token is derived from a simple subtraction from a disk 
used token and a total disk space token (Col. 9, Lines 42-49). A spot alert could result 
when the number of parity errors exceeds a predetermined threshold, or when the root 
partition of a disk exceeds 99%, and an alert would be issued (Col. 12, Lines 4-13). As 
seen, the technique as discussed indicates the step of deriving said data about said 
system attribute for determining from said derived data if said condition exists, and upon 
determining that said condition exists notifying said client of the existence of said condition. 
Wookey does not explicitly teach the step of querying said system as specified by the alert 
as request, and fails to disclose an SQL query comprises an SQL view is used to specify a 
query. However, as disclosed by Wookey, an alert type is defines in a manner similar to 
a token type defining a token (Col. 12, Lines 46-48). If an alert is to determine if a 
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particular partition has exceeded a predetermined percentage used, the alert includes a 
token for the partition name, /var, and a second token is partition percentage used. The 
alert determines if partition name =/var AND percentage used is 80%. When those two 
conditions are true, the alert is raised (Col. 12, Lines 44-55). A token type is defined in 
order to extract information from the diagnostic data by having in each token a token 
name and a test name (Col. 7, Lines 10-20). The diagnostic tests are run, and the 
results of those diagnostic tests are automatically provided at periodic intervals (Col. 3, 
Line 63-Col. 4, Line 10). As seen, within an alert is a token, and obviously, the test for 
querying the system must be specified in the alert or request in order to have a partition 
percentage used as in the example above. 

Sybase teaches SQL as a high-level language includes commands for retrieving 
data from a database, creating database object and other functions (Sybase, Chapter 1 : 
Introduction, Overview). As shown in Chapter 1 is the method of creating SQL 
statements by using select command. As shown in Chapter 14 is the method of creating 
trigger conditions by using SQL statements. Sybase further discloses: SQL query 
comprises an SQL view (Sybase, Chapter 8, Views: Limiting access to Data, Creating 
Views). 

Therefore, it would have been obvious for one of ordinary skill in the art at the 
time the invention was made to include the test for querying the system in the alert and 
using SQL to implement the test in order to issue an alert indicating predefined 
condition exist in a computer system. 
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Regarding to claim 14, Wookey teaches all the claimed subject matters as 
discussed in claim 1 3, but fails to teach information specifying a query for said system 
attribute is an SQL query. Sybase teaches SQL as a high level language for relational 
database system and using query as a request for retrieval of data by using the select 
command (Sybase, Chapter 1: Introduction, Overview and Queries, Data Modification). 
Therefore, it would have been obvious for one of ordinary skill in the art at the time the 
invention was made to use SQL for implementing the test in order to issue an alert 
indicating predefined condition exist in a computer system. 
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Conclusion 



7. Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to HUNG Q PHAM whose telephone number is 703- 
605-4242. The examiner can normally be reached on Monday-Friday. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, JOHN E BREENE can be reached on 703-305-9790. The fax phone 
number for the organization where this application or proceeding is assigned is 703- 
872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

Examiner Hung Pham 



July 12, 2004 




